SOX Section 404: What Does It Mean? What Should You Do?

SOX 404 requires that the annual report of a public company include a statement by management on the company's internal controls over financial reporting and the underlying systems and IT processes affecting the financials. That statement must also be affirmed by an auditor.

This can be a particularly difficult challenge when businesses lack the large IT budgets necessary to manage a compliance process effectively, in addition to day-to-day operational controls. This is precisely why the SEC decided to defer mandates for compliance with SOX 404 by businesses with a market cap of less than $75 million from July 2005 until July 2007.

It's expensive for companies of your size, too. According to a recent study done by the Small Business Administration, smaller businesses pay an average of 46 percent more per employee in meeting federal regulations for compliance than their larger counterparts. This is due in large part to the very nature of a business of your size having a workforce that is lean and nimble. It also stems from having to deal with an auditing process that appears overwhelming and loosely defined, and often entails a process of "rediscovery" of the circumstances surrounding events of long ago.

The problem lies in the fact that most companies with a market cap of less than $75 million that have IT departments lack the IT manpower, expertise, and resources necessary to begin a dedicated audit process. Whatever IT budget and manpower exists is prioritized for systems that directly drive product or services, versus controls initiatives.

In contrast, large corporations are able to rely on their own internal expertise to put controls and processes in place before an external auditor identifies areas of weakness. When businesses begin the audit process they often can use specialized consultants or external advisors who make recommendations of where internal processes and controls can be improved. That forces those companies to pay for the audit review process twice, but they usually get it right the first time.

Buyers Beware

With the deluge of attention being given to SOX today, many companies have come to the market claiming to have effective SOX solutions. But buyers should be wary: Very few one-stop compliance services are available in the market today. There are, however, a few steps a business of your size can take to get the ball rolling on the way to compliance with SOX 404.

The first step you should take is to identify the gaps within current internal financial controls. While this may require the assistance of an outside expert, it will get you closer to the final solution before the audit begins.